{"id":53580,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd"},"modified":"2021-02-01T11:40:32","modified_gmt":"2021-02-01T09:40:32","slug":"uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","title":{"rendered":"OpenBSD haavatavused, mis v\u00f5imaldavad \u00f5iguste t\u00f5stmist ja autentimise \u00fcmbersuunamist smtpd, ldapd ja radiusd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Qualys ettev\u00f5te <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.qualys.com\/laws-of-vulnerabilities\/2019\/12\/04\/openbsd-multiple-authentication-vulnerabilities\">tuvastas<\/a><\/noindex> neli <noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualys.com\/2019\/12\/04\/cve-2019-19521\/authentication-vulnerabilities-openbsd.txt\">haavatavuse<\/a><\/noindex> OpenBSD-s on \u00fcks protokoll, mis v\u00f5imaldab kaugt\u00e4iendusi teatud v\u00f5rguteenustele autentimata, samas kui kolm muud aitavad t\u00f5sta s\u00fcsteemis privileege. Qualysis m\u00e4rgitud, et OpenBSD arendajad reageerisid kiiresti \u2014 k\u00f5ik probleemid lahendati. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">on k\u00f5rvaldatud<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata65.html\">OpenBSD 6.5<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">OpenBSD 6.6<\/a><\/noindex> 40 tunni jooksul p\u00e4rast privaatset teavitamist.<\/p>\n<p>Kaugelt \u00e4ra kasutatav haavatavus on p\u00f5hjustatud t\u00f5rkest autentimise k\u00e4sitleja kutsumise korraldamises libc teegis, mis kutsub esile<br \/>\nprogrammi \/usr\/libexec\/auth\/login_style koos k\u00e4ivitusargumentide edastamisega. Sealhulgas v\u00f5imaldab login_style-i k\u00e4ivitamine valikulise parameetriga \u00ab-s service\u00bb edastada protokolli nime. Kui kasutajanime alguses on m\u00e4rk \u00ab-\u00bb, t\u00f6\u00f6deldakse seda nime kui valikut login_style-i k\u00e4ivitamisel. Seega, kui autentimisel antakse kasutajanimeks \u00ab-schallenge\u00bb v\u00f5i \u00ab-schallenge:passwd\u00bb, siis login_style t\u00f5lgendab kutsumist k\u00e4suna t\u00f6\u00f6tleja kasutamiseks. <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/S\/Key\">S\/Key<\/a><\/noindex>.<\/p>\n<p>Probleem on selles, et S\/Key protokoll login_style-is toetatakse vaid formaalselt, reaalsuses aga ignoreeritakse ning tulemuseks on edukas autentimise t\u00f5end. Seet\u00f5ttu v\u00f5ib r\u00fcndaja, esitledes end kasutajana \u00ab-schallenge\u00bb, m\u00f6\u00f6da minna autentimisest ja p\u00e4\u00e4seda ligi ilma parooli v\u00f5i v\u00f5tmeteta. K\u00f5ik v\u00f5rgu teenused, mis kasutavad libc standardk\u00f5nesid autentimiseks, on potentsiaalselt haavatavad. N\u00e4iteks on autentimise ajal m\u00f6\u00f6da minek v\u00f5imalik smtpd (AUTH PLAIN), ldapd ja radiusd teenustes.<\/p>\n<p>sshd-s haavatavus ei ilmne, kuna seal on lisakaitse, mis kontrollib, kas kasutaja on s\u00fcsteemis olemas. Siiski v\u00f5ib sshd-d kasutada s\u00fcsteemi haavatavuse kontrollimiseks \u2014 kasutajanime \u00ab-sresponse:passwd\u00bb kasutamisel katkeb \u00fchendus, kuna sshd ootab login_passwd-i tagasiloodud parameetreid (challenge), samas kui login_passwd ootab puuduvaid parameetreid (nimi \u00ab-sresponse\u00bb t\u00f5lgendatakse kui valik). Potentsiaalne kohalik r\u00fcndaja v\u00f5ib proovida m\u00f6\u00f6da minna autentimisest su utiliidis, kuid nime \u00ab-sresponse\u00bb edastamine viib protsessi kokkuvarisemiseni nullviidatud tagastamise t\u00f5ttu getpwnam_r-funktsiooni t\u00e4itmisel (\u00ab-schallenge\u00bb, ...).<\/p>\n<p>Teised haavatavused:<\/p>\n<ul>\n<li class=\"l\">  CVE-2019-19520 \u2014 lokaalselt privileegide t\u00f5stmine xlock t\u00f6\u00f6riista manipuleerimise kaudu, mis on tarnitud sgid-flagiga, vahetades r\u00fchma \u00abauth\u00bb. xlocki koodis keelatakse teekide teed \u00fcle m\u00e4\u00e4rata ainult kasutaja identifikaatori (setuid) muutmisel, mis v\u00f5imaldab r\u00fcndajal muuta keskkonnamuutujat \u00abLIBGL_DRIVERS_PATH\u00bb ja korraldada oma jagatud teegi laadimise, mille kood k\u00e4ivitatakse p\u00e4rast privileegide t\u00f5stmist r\u00fchma \u00abauth\u00bb.<\/li>\n<li class=\"l\"> CVE-2019-19522 \u2014 v\u00f5imaldab lokaalsel kasutajal, kes kuulub r\u00fchma \u00abauth\u00bb, k\u00e4ivitada koodi root \u00f5igustes S\/Key v\u00f5i YubiKey autentimise s\u00fcsteemi sissel\u00fclitamise korral (vaikimisi mittetoimiv). Kuulumine r\u00fchma \u00abauth\u00bb, millele p\u00e4\u00e4seb juurde eelnevalt nimetatud xlocki haavatavuse kasutamise kaudu, v\u00f5imaldab faile kirjutada kaustadesse \/etc\/skey ja \/var\/db\/yubikey. N\u00e4iteks v\u00f5ib r\u00fcndaja lisada uue faili \/etc\/skey\/root, et genereerida \u00fchekordseid v\u00f5tmeid autentimiseks root kasutaja all S\/Key kaudu.<\/li>\n<li class=\"l\"> CVE-2019-19519 \u2014 v\u00f5imalus t\u00f5sta ressursipiiranguid su t\u00f6\u00f6riista manipuleerimise kaudu. Kui kasutada valikut \u00ab-L\u00bb, mis t\u00e4hendab katsetuste kordamist autentimise eba\u00f5nnestumise korral, m\u00e4\u00e4ratakse kasutajaklass vaid \u00fcks kord ja ei nullita j\u00e4rgmistel katsetel. R\u00fcndaja v\u00f5ib teha \u00absu -l -L\u00bb ja esimesel katse korral sisestada kellegi teise kasutajanime teistsuguse kasutajaklassiga, kuid teisel katsetusel edukalt autentida ennast. Sellises olukorras seatakse kasutajale piirangud, mis vastavad esimesel katsekorral m\u00e4rgitud kasutajaklassile (n\u00e4iteks maksimaalne protsesside arv v\u00f5i protsessi m\u00e4lu suurus). Meetod t\u00f6\u00f6tab ainult privileegideta kasutajatelt piirangute laenamiseks, kuna root kasutaja jaoks on vajalik kuuluda wheel r\u00fchma).<\/li>\n<\/ul>\n<p>Lisaks v\u00f5ib m\u00e4rkida <noindex><a rel=\"nofollow\" href=\"http:\/\/undeadly.org\/cgi?action=article;sid=20191202105849\">rakendus<\/a><\/noindex> OpenBSD-s on uus meetod s\u00fcsteemik\u00f5nede kehtivuse kontrollimiseks, mis muudab haavatavuste \u00e4rakasutamise keerulisemaks. Meetod lubab s\u00fcsteemik\u00f5nesid teostada ainult siis, kui neid tehakse eelnevalt registreeritud m\u00e4lu piirkondadest. M\u00e4lu piirkondade m\u00e4rgistamiseks <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-cvs&amp;m=157500930922882&amp;w=2\">on pakutud<\/a><\/noindex> uus s\u00fcsteemik\u00f5ne <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/msyscall\">msyscall()<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51979\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u0430 \u0442\u0440\u0438 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Qualys \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0431\u044b\u0441\u0442\u0440\u0430\u044f \u0440\u0435\u0430\u043a\u0446\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 OpenBSD &#8212; \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 OpenBSD 6.5 \u0438 OpenBSD 6.6 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 40 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53580","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-02-01T09:40:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenBSD haavatavused, mis v\u00f5imaldavad t\u00f5sta privileege ja m\u00f6\u00f6da minna autentimisest smtpd, ldapd ja radiusd | ProHoster","description":"Qualys leidis neli","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-02-01T09:40:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53580","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:57:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-01-24 07:57:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53580"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53580\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}